Jose Alberto Hernandez created FINERACT-2962:
------------------------------------------------
Summary: Upgrade Spring Boot to 4.1.1 to fix CVE-2026-47884 and
CVE-2026-47890
Key: FINERACT-2962
URL: https://issues.apache.org/jira/browse/FINERACT-2962
Project: Apache Fineract
Issue Type: Task
Reporter: Jose Alberto Hernandez
*Background*
{\{develop}} is on Spring Boot 4.1.0, which brings Spring Framework 7.0.8. Two
CVEs published on 2026-08-20 affect \{{spring-webmvc}} 7.0.0 - 7.0.8 and are
fixed in Spring Framework 7.0.9, which ships with Spring Boot 4.1.1:
* *CVE-2026-47884*: RCE/SSRF via \{{XsltView}}
([https://spring.io/security/cve-2026-47884])
* *CVE-2026-47890*: SSE stream corruption with view fragments
([https://spring.io/security/cve-2026-47890])
*Problem / Motivation*
Container scanners (e.g. Trivy, which uses the GHSA score) flag both CVEs as
CRITICAL (CVSS 9.8). Spring rates them 5.8 and 2.6. Images built from
\{{develop}} therefore fail any CVSS >= 9 gate.
Fineract does not appear to be exploitable: \{{spring-webmvc}} is on the
classpath (\{{spring-boot-starter-webmvc}}, springdoc) and Spring MVC serves
the Thymeleaf login page (\{{LoginController}}), but the codebase has no use of
\{{XsltView}}, \{{SseEmitter}}, \{{FragmentsRendering}} or \{{ModelAndView}},
which are the preconditions of both CVEs. The REST API itself is served by
Jersey. This is a code search, not an exploitability analysis.
The upgrade is not a version bump only. Spring Boot 4.1.1 changed the signature
of \{{JpaBaseConfiguration#entityManagerFactoryBuilder}}: the last parameter
\{{Map<String, AsyncTaskExecutor> taskExecutors}} was replaced by
\{{ListableBeanFactory beanFactory}}. \{{JPAConfig}} overrides that method, so
\{{develop}} does not compile against 4.1.1 until the override is adapted.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
